Windows Security Log Event ID 516

516: Internal resources allocated for the queuing of audit messages have been exhausted, leading to the loss of some audits

On this page

• Description of this event
• Field level details
• Examples

Event 516 indicates that an extremely high period of activity prevented Windows from logging %1 number of security events.

Free Security Log Resources by Randy

• Free Security Log Quick Reference Chart
• Windows Event Collection: Supercharger Free Edtion
• Free Active Directory Change Auditing Solution
• Free Course: Security Log Secrets

Description Fields in 516

• Number of audit messages discarded: number of events not logged

Supercharger Free Edition

 

 

Upcoming Webinars Patching Humans Against Social Engineering AI Usage by Employees: Understand the Risks and Mitigations Before Choosing What to Do About It Identifying the Tier 0 Assets in Your Active Directory Environment is Step #1 in ITDR

Additional Resources

•	Event IDs
•	All Event IDs
•	Audit Policy